UpHeron
All vulnerabilities

Servers and applications

CVE-2023-30586

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for…

Severity
High 7.5
Published
1 Jul 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
20.3.1
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 20.0.0 before 20.3.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-30586
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-30586